12/23/2005 14:46 FAX 1 858 678 5099 FISH AND RICHARDSON 1003/034 

Attomey'B Docket No.: 18897-002001/ J.150-110US 

Amendment to the Claims ; 

This listing of claims replaces all prior versions, and 
listings, of claims in the application: 

1. (Currently amended) A method for identifying 
conditions affecting a computer network, the network having a 
mechanism for sending packet bursts along a path in the network 
and receiving said packet bursts at an end of the path, the 
method comprising: 

providing a plurality of example signatures, each of the 
example signatures corresponding to a network condition ,- 

acquiring test data regarding propagation of test packets 

along the path; 

creating a test signature from the test data; 
comparing the test, signature to the example signatures; 

and, 

identifying at leaBt one of the example signatures which 
matches the test signature according to a match criterion^ 
thereby identifying at least one con dition affecting the 
computer network . 

2. (Original) The method of claim 1 wherein comparing 
the test signature to the example signatures comprises computing 
a similarity measure between the test signature and each of the 
example signatures. 
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3. (Original) The method of claim 1 wherein 

the test signature comprises a plurality of values, 

each of the example signatures comprise a set of 

corresponding values and, 

computing the similarity measure between the test signature 

and an example signature comprise computing a fit between each 

of the values of the teat signature and the corresponding value 

of the example signature. 

4. (Original) The method of claim 3 wherein computing a 
fit between a value of the test signature and a corresponding 
value of the example signature is performed by evaluating a 
function associated with the value. 

5. (Original) The method of claim 3 wherein, computing 
the fit between each of the values of the test signature and the 
corresponding value of the example signature comprises 
performing a computation substantially mathematically equivalent 

to: 

G(x,m)=A exp(-B(x-m) 2 ) 

where x is a value in the test signature, m is the 
corresponding value of the example signature and A and B are 
coefficients . 
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6. (Original) The method of claim 3 wherein computing 
the fit between each of the values of the test signature and the 
corresponding value of the example signature comprises 
performing a computation eubstantially mathematically equivalent 

tO: 

where x is a value in the test signature, m is the 
corresponding value of the example signature, and C and X are 
coefficients . 

7. (Currently amended) The method of claim 6 wherein 
values for C and .lambda, X are associated with each 
corresponding value of the example signature and performing the 
computation comprises using the values for C and . lambda . X 
associated with the corresponding value of the example signature 
with which the fit to a value of the test signature is being 
computed. 

8. (Original) The method of claim 2 wherein computing a 
similarity measure comprises performing a chi- squared 
calculation. 
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9. (Original) The method of claim 2 comprising 
normalizing the similarity measures corresponding to the example 
signatures before identifying at least one of the example 
signatures which matches the test signature , 

10. (Original) The method of claim 9 wherein normalizing 
the similarity measures is based at least in part upon the 
similarity measure that would be obtained in a lossless network. 

11. (Original) The method of claim 10 wherein normalizing 
the similarity measures is based at least in part upon the 
similarity measure that would be obtained if the test signature 
and example signature were identical , 

12. (Original) The method of claim 11 wherein normalizing 
the similarity measures comprises evaluating for each similarity 
measure : 

where FIT is the similarity measure, Fnor*»iizea is tn ® 
normalized similarity measure, F M low is the similarity measure 
that would be obtained if the test data reported no loss of 
packets and Fmatch is the similarity measure that would be 
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obtained if the test signature and example signature were 
identical . 

13. (Original) The method of claim 9 comprising adjusting 
one or more of the similarity measures based upon an individual 
set of ruleB associated with that similarity measure before 
identifying at least one of the example signatures which matches 
the test signature. 

14. (Original) The method of claim 13 wherein the 
individual set of rules includes one or more rules based upon 
factors including one or more of: a number of ICMP network 
unreachable messages; a number of ICMP host unreachable 
messages; a number of ICMP destination unreachable messages; a 
number of ICMP port unreachable messages; a number of ICMP 
protocol unreachable messages; a number of ICMP fragmentation 
required messages; a number of ICMP TTL expired messages; a 
number of ICMP source quench messages; a number of ICMP redirect 
messages; a number of ICMP router advertisement messages; a 
number of ICMP parameter problem messages; a number of ICMP 
security problem messages; a number of unsolicited packets; a 
number of out -of -sequence packets; a non-standard MTU detected; 
and a number of timed out packets. 
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15. (Original) The method of claim 1 wherein the test 
signature comprises, packet loss statistics for a plurality of 
positions within bursts of test packets of a first size. 

16. (Original) The method of claim 15 wherein the test 
signature comprises, packet loss statistics for a plurality of 
positions within bursts of test packets of a second size. 

17. (Original) The method of claim 16 wherein one of the 
first and second sizes is not more than three times a minimum 
packet size for the path. 

18. (Currently Amended) The method of claim 17 wherein 
the other one of the first and second sizes is within 10% of a 
maximum packet size for the path. 

19. (Original) The method of claim 16 wherein one of the 
first and second sizes is within 10% of a maximum packet size 
for the path. 

20. (Original) The method of claim 16 wherein the test 
signature comprises, packet loss statistics for a plurality of 
positions within bursts of test packets of a third size wherein 
the third size is intermediate the first and second sizes. 



PAGE 8f34 ' RCVD AT 12/23/2005 5:43:53 PM [Eastern Standard Time] * SVR:USPTO-ff XRF-6/27 ' DMS:2738300 * CSID:1 858 6/8 5099 ' DURATION (mm-ss):1040 



12/23/2005 14:48 FAX 1 858 678 5088 FISH AND RICHARDSON 



1 008/034 



Attorney's Docket No.: 18897-002001/1150-llOUS 

21. (Original) The method of claim 1 wherein the test 
signature comprises a mean packet loss for bursts of packets of 
each of a plurality of sizes. 

22. (Original) The method of claim 21 comprising 
determining the mean packet loss, BrAvg substantially as 

follows : 

B 

where n is a number of packetB in each burst, 1 A is the loss 
ratio for the i th packet in the burst and i is an index which 
ranges over all of the packets in the burst. 

23. (Original) The method of claim 1 wherein the test 
signature comprises a first moment of packet losses within 
bursts of packets of a given size. 

24. (Original) The method of claim 1 wherein the test 
signature comprises a first moment of packet losses within 
bursts of packets for bursts of packets of each of a plurality 
of sizes. 
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25. (Original) The method of claim 24 comprising 
determining the first moment of packet losses, BrMom, 
substantially as follows: 

$iMamm — — 



where lj." is the loss ratio for the i Eh packet in the burst 
and i is an index which ranges over all of the packets in the 
burst . 

26. (Original) The method of claim 1 wherein the test 
data includes data regarding the propagation of datagrams along 
the test path. 

27. (Original) The method of claim 26 wherein the test 
signature comprises one or more packet loss statistics for the 
datagrams . 

28. (Original) The method of claim 27 wherein the test 
data comprises information regarding the propagation of 
datagrams of a plurality of sizes along the test path and the 
test signature comprises packet loss statistics for datagrams of 
each of the plurality of sizes. 
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29. (Original) The method of claim 1 wherein the path is 
a closed path. 

30. (Original) The method of claim 29 wherein the packets 
comprise ICMP ECHO packets. 

31. (Original) The method of claim 6 wherein the test 
signature comprises a mean packet loss for bursts of packets of 
each of a plurality of sizes. 

32. (Original) The method of claim 31 comprising 
determining the mean packet loss, BrAvg substantially as 
follows : 

P 

fr^W o m 

where n is a number of packets in each burst, U is the loss 
ratio for the i th packet in the burst and i is an index which 
ranges over all of the packets in the burBt. 

33. (Original) The method of claim 16 wherein the test 
signature comprises a first moment of packet losses within 
bursts of packets of the first size. 
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34. (Original) The method of claim 16 wherein the teat 
signature comprises a first moment of packet losses within 
bursts of packets for bursts of packets of each of the first and 
second sizes. 

35. (Original) The method of claim 34 comprising 
determining the fir B t moment of packet losses, BrMom, 
substantially as follows: 

M 

where U is the loss ratio for the 1 th packet in the burst 
and i is an index which ranges over all of the packets in the 
burst . 

36. (Original) The method of- claim 16 wherein the 
plurality of example signatures comprise example signatures 
corresponding to two or more of: a small queues condition; a 
lossy condition; a half-full duplex conflict condition; a full- 
half duplex conflict condition; an inconsistent MTU condition; a 
long half -duplex link condition; and a media errors condition. 

37. (Currently amended) Apparatus for identifying 

conditions affecting a computer network, the network having a 
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mechanism for sending packets in bursts along a path in the 
network and receiving the packet bursts at an end of the path, 
the apparatus comprising; 

a data store holding a plurality of example 
signatures, each of the example signatures corresponding to 
a network condition; 

an input for receiving test data regarding propagation 
of test packets along the path; 

means for creating a test signature from the test 

data; 

means for comparing the test signature to the example 
signatures ; and, 

means for identifying at least one of the example 
signatures which matches the test signature, thereby 
identifying at least one condition affecting the computer 
network - 

38. (Original) The apparatus of claim 37 wherein the 
means for identifying at least one of the example signatures 
which matches the test signature comprises an expert system and 
a rule base. 
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39, (Original) The apparatus of claim 38 wherein the rule 
base includes rules which accept as input additional information 
other than the test signature* 

40. (Original) The apparatus of claim 39 wherein the 
additional information comprises one or more of; a number of 
ICMP network unreachable messages; a number of ICMP host 
unreachable messages; a number of ICMP destination unreachable 
messages; a number of ICMP port unreachable messages; a number 
of ICMP protocol unreachable messages; a number of ICMP 
fragmentation required messages; a number of ICMP TTL expired 
messages; a number of ICMP source quench messages; a number of 
ICMP redirect messages; a number of ICMP router advertisement 
meg g a ges ; a number of ICMP parameter problem messages; a number 
of ICMP security problem messages; a number of unsolicited 
packets; a number of out -of -sequence packets; a non-standard MTU 
detected; 

and a number of timed out packets, 

41. (Original) The apparatus of claim 37 wherein the 
example signatures comprise example signatures corresponding to 
two or more of: a small queues condition; a lossy condition; a 
half-full duplex conflict condition; a full-half duplex conflict 
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condition; an inconsistent MTU condition; a long half-duplex 
link condition; and a media errors condition. 

42. (Original) The apparatus of claim 40 wherein the 
means for comparing the test signature to the example signatures 
comprises means for calculating a similarity measure between the 
test signature and each of the example signatures. 

43. (Previously presented) The apparatus of claim 42 
wherein the test signature comprises a plurality of values, each 
of the example signatures comprise a set of corresponding values 
and, the means for calculating a similarity measure between the 
test signature and each of the example signatures comprises 
means for computing a fit between each of the values of the test 
signature and the corresponding value of the example signature. 

44. (Original) The apparatus of claim 42 wherein the 
means for comparing the test signature to the example signatures 
comprises a neural network. 

45. (Currently amended) Apparatus for identifying 
conditions affecting a computer network, the network having a 
mechanism for sending packets in bursts along a path in the 
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network and receiving the packet bursts at an end of the path, 
the apparatus comprising: 

a data store holding a plurality of example signatures, 
each of the example signatures corresponding to a network 
condition; 

an input for receiving test data regarding propagation of 
test packets along the path; 

a teat signature creation mechanism configured to create a 
test signature based upon the teat data? 

a comparison system configured to derive a similarity 
measure between [ [a] ] the test signature and each of the 
plurality of example signatures; and, 

a selection system configured to identify at least one of 
the example signatures which best matches the test signature^ 
thereby identifying at least one conditio n affecting the 
computer network , 

46. (Original) The apparatus of claim 45 comprising a 
data processor wherein the test signature creation mechanism, 
comparison system, and selection system each comprise a set of 
software instructions in a program store accessible to the 
processor. 
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47. (Original) The apparatus of claim 45 wherein the 
example signatures comprise, packet loss statistics for a 
plurality of positions within bursts of test packets of a first 
size - 

48. (Original) The apparatus of claim 47 wherein the 
example signatures comprise packet lose statistics for a 
plurality of positions within bursts of test packets of a second 
size . 

49. (Original) The apparatus of claim 4 8 wherein the 
example signatures comprise packet loss statistics for a 
plurality of positions within bursts of test packets of a third 
size wherein the third size is intermediate the first and second 
sizes . 

50. (Original) The apparatus of claim 49 wherein the 
example signatures comprise a mean packet loss for bursts of 
packets of each of a plurality of sizes. 

51. (Original) The apparatus of claim 49 wherein the 
example signatures comprise a first moment of packet losses 
within bursts of packets of a size. 
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52. (Original) The apparatus of claim 49 wherein the 
example signatures comprise a first moment of packet losses 
within bursts of packets for bursts of packets of each of a 
plurality of sizes . 

53. (0ri9inal) The apparatus of claim 49 comprising a 
test packet sequencer connected to dispatch a sequence of test 
packets along a network path. 

54. (Original) The apparatus of claim S3 wherein the test 
packet sequencer is configured to generate and to dispatch onto 
the path multiple bursts of ICMP ECHO packets, 

55. (Original) The apparatus of claim 45 comprising a set 
weighting coefficients, fitting coefficients, or both weighing 
and fitting coefficients associated with one or. more of the 
example signatures . 

56. (Currently amended) A program product comprising a 
computer readable medium carrying a set of computer- readable 
signals comprising instructions which, when executed by a 
computer processor, cause the data processor to execute a method 
for identifying conditions affecting a computer network, the 
network having a mechanism for sending packet bursts along a 
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path in the network and receiving said packet bursts at an end 
of the path, the method comprising: 

providing a plurality of example signatures, each of the 
example signatures corresponding to a network condition; 

acquiring test data regarding propagation of test packets 
along the path; 

creating a test signature from the test data; 

comparing the test signature to the example signatures; 

and, 

identifying at least one of the example signatures which 
matches the test signature according to a match criterion^ 
thereby identifying at least one condition affecting the 
computer network , 

57. (Previously presented) The method of claim 15 wherein 
the test signature further comprises additional measures. 

58 ■ (Previously presented) The method of claim 57 wherein 
the additional measures include one or more of: measures derived 
from packet or burst loss statistics; measures derived from 
other statistics relating to propagation of test packets along 
the path; relative measures; and test conditions. 
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59. (Previously presented) The method of claim 57 wherein 
the additional measures are based on ICMP messages from network 
devices along the path, the ICMP messages containing information 
relating to one or more of: network errors; network congestion; 
and packet timeouts. 

60. (Previously presented) The method of claim 57 wherein 
the additional measures are based on information regarding 
network topology including one or more of : maximum transfer 
unit r RMON message; and SNMP message, 

61. (Previously presented) The method of claim 1 wherein 
the test data comprises information regarding one or more of: 
connectivity , maximum transmission unit, network device 
responsivity; and time for test packets to traverse the path. 

62. (Previously presented) The method of claim 1 wherein 
the test data comprises information regarding one or more of; 
lost packets; final inter-packet separation; hop number, hop 
address, measured MTU, reported MTU, error flag and information 
relating to the packet bursts prior to sending along the path. 
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63 . (Previously presented) The method of claim 62 wherein 
the test data comprises information regarding derivatives of 
said information, 

64. (Previously presented) The method of claim 1 wherein 
the teat signature comprises one or more functions, the one or 
more functions relating to one or more of: packet loss 
statistics; round trip time; and final inter-packet spacing. 

65. (Previously presented) The method of claim 64 wherein 
the test signature comprises one or more higher-order functions 
derived from said one or more functions* 

66. (Previously presented) The method of claim 29 wherein 
one or more of the test packets are formatted using TCP protocol 
or UDP protocol - 

67. (Previously presented) The method of claim 66 wherein 
the one or more test packets formatted using TCP or UDP protocol 
are returned from an end host by software or hardware. 

68 . (Previously presented) The method of claim 66 wherein 
the test signature comprises packet loss statistics derived from 
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the one or more of the test packets formatted using TCP protocol 
or UDP protocol > 

69, (Previously presented) The method of claim 1 wherein 
the path is an open path wherein test packets are sent from one 
location and received at a different location. 

70. (Previously presented) The method of claim 69 wherein 
the test signature comprises packet loss statistics. 
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